-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 07 Sep 2026 07:26:28 -0300 Source: pyasn1 Architecture: source Version: 0.4.8-3+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: Jan Lübbe <jluebbe@debian.org> Changed-By: Emmanuel Arias <eamanu@debian.org> Closes: 1142388 Changes: pyasn1 (0.4.8-3+deb12u3) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs. The BER decoder accumulated tag continuation octets without an upper bound, so a crafted substrate could force construction of an arbitrarily large integer with quadratic CPU cost (Closes: #1142388). * CVE-2026-59885: fix quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID decoding and encoding, which allowed denial of service via a small payload with many arcs. * CVE-2026-59886: uncontrolled resource consumption when converting decoded real values. univ.Real convertedts mantissa, base, exponens to a Python float using exact big-integer exponentiation, so a real value only a few bytes long could carry a very large exponent. Checksums-Sha1: be7d39c691eca69e3c1905d8f7274c25376bcde4 2268 pyasn1_0.4.8-3+deb12u3.dsc e0fa19f8fda46a1fa2253477499b116b33f67175 146820 pyasn1_0.4.8.orig.tar.gz fb2dc255119836ee24e71f39907c6dd67944f742 13400 pyasn1_0.4.8-3+deb12u3.debian.tar.xz 5a8560edf11a18e9e060946faecb26918f90bbd2 8880 pyasn1_0.4.8-3+deb12u3_source.buildinfo Checksums-Sha256: 68dcf61633e686b952e3da4e1cdc4e3667cd1368a8bbebdb9c5eaa4acf51813a 2268 pyasn1_0.4.8-3+deb12u3.dsc aef77c9fb94a3ac588e87841208bdec464471d9871bd5050a287cc9a475cd0ba 146820 pyasn1_0.4.8.orig.tar.gz a7c05c00e447441a44af3e7bb74cf95c579dab03c1d2e3f4db3b3c0b61200b23 13400 pyasn1_0.4.8-3+deb12u3.debian.tar.xz 355880eb9bbeedd9a5cdc1506a99f70d7ca6e723526ba83dac7bc278a1807a63 8880 pyasn1_0.4.8-3+deb12u3_source.buildinfo Files: 4e2503c04cd290217a1ab7d593884bd9 2268 python optional pyasn1_0.4.8-3+deb12u3.dsc dffae4ff9f997a83324b3f33fe62be54 146820 python optional pyasn1_0.4.8.orig.tar.gz fb140a65c7a6b87e73cf9270165ccf2f 13400 python optional pyasn1_0.4.8-3+deb12u3.debian.tar.xz e62533eb04fbe78ab0d1ef2e4ca3d456 8880 python optional pyasn1_0.4.8-3+deb12u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmqhvAUSHGVhbWFudUBk ZWJpYW4ub3JnAAoJEPqd7F3hHGPxbksP/imKhvKXICyQF/Yv3ictRVTktTYaMTDP bGsOvyNIbpziTFROQ4sWeugeB9MFfvKJkqkyK8P+5PvPgGjyXCiR4MxAVBPWBFCg ijzdZ++5KD8G7Jw5QjPJ9UaFEfbxadx6ApqOQ+noqEdLAuqEiA1cgPTBIXxj2fm4 3+RjSFSiVs1tnw2isRMOxQCCJBZe6lAdiC7R2iW6h7wrVJfBk75x4cRHMxQXLJcR MsTiUmX8S2oswcZgrfKiIVNdb+XqWCp7uPxwW4WsMIpJrrTbAT1MGiy30qzL56LB ruYG9g3whzshfoWPhtq+FpTa94ifa4iSySuzOHXxaqcVVM5IRTzBwQ2XYaaO5b/a +lafJovMLGW4Q+YNA1V7irW3+7PS5DvsreSo3zMw/HG7pa3dp3BxnHHCgKTO63r/ 50WGFvUVoGNC5I/l/rqOSvwSpiKeM6aB7ClN5NsPE5BNoN+j+KLupXOrr3T5fWe2 qLeOr00YmMrQFWRuYrhdfGZxjY2GaUUxJo8U2SifrZB/KRi9Y6mmL50ErkwmZGW/ iJ8b66m0JUXYIhyIiJ9YydXhmJV269G8aP45CTwVKDLi9wsSpLBDLHGumDXzf0cm 4Oye8IG4JZ79J7h56Lw+pIZk4I+I5ydcKG4RY4cJiHPD84e/uR7rl3DL2UbP2G98 IzkDGGP6od/q =X9GI -----END PGP SIGNATURE-----
